DKIM Tag not match with DNS Config

[MSabino85]

Hello everyone.

In the DNS configuration I have to validate the DKIM record postal-gVxVcR._domainkey.mta01.mydomain.com

When I send a test email, the domain it sends and validates against is rp.mta01.mydomain.com
Is it correct? or something in the DNS configuration I omitted to configure?

The DKIM signature tag is s=postal, shouldn't it be postal-gVxVcR?
To force this, in postal.yml I put dkim_identifier = postal-gVxVcR, it works.
but when doing this in the DNS configuration web, instead of validating against postal-gVxVcR._domainkey.mta01.mydomain.com, it tries to validate against postal-gVxVcR-gVxVcR._domainkey.mta01.mydomain.com
Concatenates twice the tag suffix (-gVxVcR)

With dkim_verify_prefix = postal-gVxVcR I don't notice any difference commenting it out or leaving it in.

I tried verifications with both use_local_ns_for_domain_verification: true and false with no positive results.

[willpower232]

Presumably postal-gVxVcR._domainkey.mta01.mydomain.com is a TXT record with the DKIM value from the domains page and Postal thinks all your DNS is valid and you have also added a return path domain with psrp or whatever configured?

I just sent myself an email from the web ui and got headers like this

Authentication-Results: spf=pass (sender IP is 12.34.567.89)
 smtp.mailfrom=psrp.testdomain.com; dkim=pass (signature was verified)
 header.d=testdomain.com;dmarc=bestguesspass action=none
 header.from=testdomain.com;compauth=pass reason=109

Received-SPF: Pass (protection.outlook.com: domain of psrp.testdomain.com
 designates 12.34.567.89 as permitted sender) receiver=protection.outlook.com;
 client-ip=12.34.567.89; helo=postaldomain.com; pr=C

Resent-Sender: szfa4f@psrp.testdomain.com

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=testdomain.com; s=postal-xrOULx; t=1715849512;
 bh=SiHcbximZ1Bf69t5kpZBVJmMY0kHEebNxSEjIg8gBRY=; h=date:from:to:message-id:subject:mime-version:content-type:content-transfer-encoding;
 b=A42Htw51sLyuDKtUqBdOzkDvOfWoCTCUrWZpQ3uz270JiiwvhVufEo5jEzPqOsgeRs+fphXshzRRV1QBPEJapo1IZhfQN1n5Jj
 +WwQ3zohXPeB1G09ujk1LjA0mwG5+grbVoy7d0KF2Hpmw5mwe3VzfnG13xtlef7MZtSgm+cVg=

X-Postal-MsgID: DcGomzKz7Z6N

Received: from web-ui (987.65.43.21 [987.65.43.21]) by Postal with HTTP; Thu, 16 May 2024 08:51:52 +0000

Date: Thu, 16 May 2024 09:51:52 +0100

From: test@testdomain.com

Message-ID: <7d9d4794-9b1e-4923-81f5-72bfd32149a5@rp.postaldomain.com>

Subject: Test Message at May 16, 2024 09:51

Return-Path: szfa4f@psrp.testdomain.com
``

[rakurtz]

Hey @willpower232 ,

i also ran into a lot of trouble with the dkim selectors and the information shown in the web interface.

differing selector / identifier
when not configuring anything specific in postal.yml, the s tag in the dkim signature sent in a message is just postal whilst the web interface states to add something like postal-pjixbr or similar to your DNS. Then dkim validation of course fails since the validating webserver will look for postal._domainkey.... (in my dns i added the correct value with postal-pjixbr._domainkey).

when adding the following line to postal.yml (under dns:)

  dkim_identifier:  postal-pjixbr
  dkim_selector:  postal-pjixbr

postal sets the correct s-tag in the dkim information when sending an email. i just checked with something like mail-tester.com. But I am not sure if the validation can be done successfully.

but the webinterface (under dns configuration) will show an error and tell:

WARNING No TXT records were returned for postal-pjixbr-pjixbR._domainkey.mydomain.com
You need to add a new TXT record with the name postal-pjixbr-pjixbR._domainkey with the following content.

differing domain
the webinterface shows postal[-pjixbr]_domainkey.mydomain.com while the dkim headers in the message will show postal[-pjixbr]_domainkey.rp.postal.mydomain.com. I am not sure how to deal with this. I added two TXT records to DNS to mitigate this.

i tried to add dkim_domain: maramail.eu to my postal.yml file but i didn't get the impression it had any effect.

conclusion
i tried a lot of different combinations and settings in postal.yml and started and stopped postal after each change. I think there is a bug in the software somewhere between what selector / identifier is used for sending mails and which is shown in the web interface. i was getting it right once, but i cannot get it right now. Any help would be appreciated.

@MSabino85 , did you find a solution for your server? Are you running it with the manual set selector / identifier in postal.yaml? did you encounter any long term issues from the fact, that the postal DNS check tool will show errors?

[willpower232]

dkim_selector does not seem to be a real config value so not sure where you got that from

the s tag in the dkim signature sent in a message is just postal

I couldn't reproduce this in the latest version of Postal, if you remove dkim_identifier (or set it to a single word), restart your Postal, and make sure the DNS validation passes (i.e. the dkim record exists), then the next message you send should have the correct header

[rakurtz]

Hey Will, thank you for your clarification.

I managed to get valid DNS Checke by removing the dkim related statements from the postal.yml and by starting over with a new mailserver and fresh domain (I mean in the web interface).

It might be crucial to not hit dns check until you actually set the given values at the dns server.

[willpower232]

Ah I had a think and I was able to reproduce it.

In the absence of a DKIM record for the domain you're sending from, Postal falls back to the return path one.

The documentation mentions about creating a DKIM record for the return path but Postal does not verify you did that so if you didn't then that would be a problem

https://docs.postalserver.io/getting-started/dns-configuration#return-path

It is also worth mentioning that the ._domainkey. part is implied and not mentioned in the DKIM header.

Regarding not clicking the DNS check button, depending on how your server provider is set up, this could also be a problem if it caches the non-existent response from the rest of the world.